US8234490B2 - Server certificate issuing system - Google Patents

Server certificate issuing system Download PDF

Info

Publication number
US8234490B2
US8234490B2 US12/452,255 US45225508A US8234490B2 US 8234490 B2 US8234490 B2 US 8234490B2 US 45225508 A US45225508 A US 45225508A US 8234490 B2 US8234490 B2 US 8234490B2
Authority
US
United States
Prior art keywords
server
certificate
verification
server certificate
web server
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Fee Related, expires
Application number
US12/452,255
Other languages
English (en)
Other versions
US20100111300A1 (en
Inventor
Keisuke Kido
Ichiro Chujo
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
GlobalSign KK
Original Assignee
GlobalSign KK
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from JP2007262485A external-priority patent/JP4128610B1/ja
Application filed by GlobalSign KK filed Critical GlobalSign KK
Assigned to GLOBALSIGN K.K. reassignment GLOBALSIGN K.K. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: CHUJO, ICHIRO, KIDO, KEISUKE
Publication of US20100111300A1 publication Critical patent/US20100111300A1/en
Application granted granted Critical
Publication of US8234490B2 publication Critical patent/US8234490B2/en
Expired - Fee Related legal-status Critical Current
Adjusted expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3263—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
    • H04L2209/60—Digital content management, e.g. content distribution

Definitions

  • the present invention relates to a server certificate issuing system which issues a server certificate in response to a server certificate request transmitted from a Web server.
  • SSL Secure Socket Layer
  • PKI Public Key Infrastructure
  • a key pair of a public key and a private key is generated using a certificate issuance application function incorporated into the Web server or the Web browser.
  • a Certificate Signing Request file (CSR) containing the public key is generated, and the issuance request of the server certificate is made by transmitting the generated CSR to the registration server.
  • the registration server which has received the issuance request of the server certificate performs a verifying process for the user authentication and transmits the CSR to the certificate issuing authority, after the authenticity of the user who made the issuance request of the server certificate is confirmed.
  • the certificate issuing authority performs digitally signing the public key contained in the signing request file to generate the server certificate and transmits the generated server certificate to the registration server. And then, the registration server informs the user that the server certificate is downloadable to the Web server.
  • the certificate authority issues the server certificate
  • identification of a person requesting the issuance of the server certificate is important.
  • a server certificate issuing system using domain validation has been put to practical use (for example, see Japanese Patent Laid-Open No. 2005-506737).
  • the registration server accesses a database of a domain registration server (Whois information) to contact an approver having an authority to approve the issuance of the server certificate for the relevant Web server.
  • communicating means such as telephone, e-mails or the like, whether or not the certificate request is approved is verified, and only if the approval from the approver is obtained, the certificate is issued.
  • a person having the authority to approve the issuance of the certificate is searched based on the Whois information, and the identification is performed based on the approval from the searched approver.
  • the authentication method of the Approver-Email system merely the approval from the person having the authority to approve is obtained and existence of the Web server for which the certificate is issued is not confirmed, which has caused a security problem.
  • the identification with the e-mail has a potential risk of causing the security problem in the case where the e-mail has been sniffed or the like.
  • the registration authority since the registration authority has to access the database of the domain registration authority to search the approver, there has been also a disadvantage of a complicated identification task in the registration authority.
  • confirmation of the approval has to be obtained with the communicating means such as the telephone, which has become a major impediment to automation of the issuance of the certificate.
  • said Web server comprises
  • verification page generating means for generating a verification page and indicating a verification information used for user authentication on said verification page
  • said registration server comprises
  • verification means for comparing the read verification information with the information contained in the server certificate request to verify whether or not the verification page has been generated
  • server certificate transmission means for transmitting the received server certificate to said Web server, and wherein
  • said registration server transmits the CSR to the certificate issuing server only when said verification means has judged that the verification page has been generated, as the result of the verification.
  • the server certificate issuing system comprises following features.
  • the registration server accesses the verification page to read out the verification information and to compare the read information with the information included in the server certificate request, as the user authentication procedure performed in the registration server, it is possible automatically to authenticate the identity of the person by use of the computer system provide in the registration authority (the registration server), and thus it becomes possible that the whole processes of the server certificate issuance system are carried out full-automatically. That is, the information contained in the server certificate request is electronic data and the verification information read from the verification page is also electronic data. Therefore, it becomes possible in the computer system provided in the registration server to execute the processes of the user authentication as an automated series of processes by comparing the two kinds of electronic data which have been obtained through the different channels.
  • the Web server comprises verification data generating means for generating verification data
  • the verification page generating means indicates the verification data generated by the verification data generating means on the verification page as the verification information
  • said server certificate request generating means generates the server certificate request including the generated verification data
  • the verification data may be generated by use of a predetermined rule or encrypting arithmetic formula.
  • the contents of the random verification page can be generated by combining the information having only one meaning and contained in the server certificate request such as FQDN (the common name of the Web server), application ID, user ID or application date and by performing encrypting calculation (for example using HASH function SHA-1) for the combined data to form HASH-processed data, generated as the content of random verification page.
  • the Web server adds the URL information (title) of the verification page in the certificate request, transmits the server certificate request, and notifies the registration server of it.
  • the registration server derives the URL information (title), generates the URL including FQDN (the common name of the Web server) and reads out the random verification page with http protocol.
  • the existence of the verification page can be confirmed by reading the contents of the random verification page.
  • the authenticity of the random verification page can be confirmed by verifying the identification between the contents of the random verification page and the data of the arithmetic result which are calculated with the predetermined rule or encrypting arithmetic formula.
  • Such data of the arithmetic result are obtained by calculating the application ID, user ID and application date with HASH function SHA-1.
  • the Web server comprises password generating means for generating a password
  • said server certificate request generating means generates the server certificate request including the generated password
  • the server certificate transmitting means of the registration server encrypts the server certificate and the corresponding private key using the password contained in the server certificate request and downloads the encrypted server certificate and private key to the Web server.
  • the Web server comprises status inquiry means for inquiring of the registration server as to the issuance status of the server certificate, and performs the status inquiry periodically using an assigned application ID as a key.
  • the Web server and the registration server are coupled by a SOAP interface with a pair of a request and a response, and the security is assured by encrypted communications and robust authentication with SSL communications.
  • a result of verifying the verification page is immediately returned to the Web server as a response to the certificate request. Input errors in the FQDN or the like are notified at the time of the application.
  • the Web server comprises a control panel to mainly configure and manage the Web and a mail, and the means for generating the entry screen to input the application information for the issuance of the server certificate, means for generating the password, means for generating the verification page, and the status inquiry means are loaded on the control panel.
  • the issuance and management of the server certificate can be performed under the control of the control panel which is provided in the Web server and mainly configures and manages the Web and the mail.
  • the means for generating the entry screen to input the application information for the issuance of the server certificate, the means for generating the password, the means for generating the verification page, and the status inquiry means are loaded on the control panel, processes from the application for the issuance of the server certificate to installation of the issued server certificate can be automatically executed in series by utilizing these means.
  • the registration server further comprises means for receiving the server certificate transmitted from the certificate issuing server, means for storing the received server certificate in a download area, means for responding to the certificate status inquiry transmitted from the above described Web server, and download means for downloading the server certificate stored in the download area to the Web server, and when the registration server receives the certificate status inquiry from the Web server, if a corresponding server certificate is stored in the download area, as a response to the above described status inquiry, the server certificate stored in the download area is downloaded to the Web server, and wherein the processes from the application for the issuance of the server certificate to the downloading of the issued server certificate to the Web server are automatically executed in series.
  • the registration sever accesses the Web server identified by the FQDN to read out the verification information indicated on the verification page, and judges the authenticity of the verification page by comparing the read verification information with the application information contained in the server certificate request. Thereby, the existence of the Web server for which the server certificate is to be issued is confirmed, and the intention of the administrator of the Web server to request the issuance of the server certificate is also confirmed. As a result, the higher security than the conventional domain validation method is assured.
  • the key pair and the CSR are generated by the registration server, the procedural burden on the user is significantly reduced.
  • FIG. 1 is a diagram showing an overall configuration of a server certificate issuing system according to the invention
  • FIG. 2 is a diagram showing an example of a Web server according to the invention.
  • FIG. 3 is a diagram showing an example of an SSL certificate issuing and managing program loaded in the Web server
  • FIG. 4 is a diagram showing an example of a computer system of a registration server
  • FIG. 5 is a diagram showing a series of operations and processes among the Web server, the registration server and a certificate issuing server;
  • FIG. 6 is a diagram showing a variation of the SSL certificate issuing and managing program loaded in the Web server.
  • FIG. 7 is a diagram showing a variation of the computer system of the registration server.
  • FIG. 1 is a diagram showing an overall configuration of a server certificate issuing system according to the invention.
  • n Web servers 1 to n under the control of a hosting provider are connected, and another Web server m owned by a person other than the hosting provider is also connected.
  • the Web servers 1 to n under the control of the hosting provider are used via the network 1 and respective terminals 1 to n by each server administrators having management authority for the respective Web server.
  • the Web server m is managed via the network 1 and another terminal m by an administrator of the server.
  • a registration server 10 provided in a registration authority which accepts a server certificate request is connected to the network 1 .
  • the registration server 10 is connected to a certificate issuing server 11 provided in an issuing authority (IA) via the network.
  • the certificate issuing server 11 receives a CSR transmitted from the registration server 10 , and provides a digital signature to issue a server certificate.
  • the issued certificate is transmitted to the registration server, and is downloaded to the relevant Web server via the network.
  • functions from the server certificate request to downloading of the issued certificate are incorporated into a control panel.
  • the control panel for mainly configuring and managing the Web and the mail is incorporated, and the application and management of the SSL certificate are performed under the control of the control panel in this example.
  • the administrator of the Web server 1 desires the issuance of the server certificate
  • the administrator accesses the Web server 1 managed by him/her via the terminal 1 and the network to display a menu of the control panel.
  • the control panel displays an entry screen to input application information for the server certificate.
  • the application information for the issuance of the server certificate includes at least the following information:
  • the control panel determines that the server certificate request has been made, and generates a server certificate request.
  • the generated server certificate request is transmitted to the registration server 10 via the network, and an examination including user authentication is performed in the registration server. If the certificate issuance request satisfies predetermined requirements, the registration server 10 generates a key pair of a private key and a public key, and further generates the CSR including the public key and transmits the generated CSR file to the certificate issuing server 11 provided in the issuing authority.
  • the certificate issuing server provides a digital signature to generate the server certificate.
  • the generated server certificate is transmitted to the registration server 10 and stored in a download area, and the registration server notifies the Web server 1 of completion of the downloading.
  • the control panel of the Web server 1 When receiving the download notification, the control panel of the Web server 1 transmits a download request to the registration server and installs the downloaded server certificate therein.
  • the certificate request is inputted by the administrator of the Web server
  • processes from the application for the issuance of the certificate to the installation of the server certificate are executed in series under the control of the control panel incorporated in the Web server. Therefore, the sequential processes of issuing the server certificate are automated and a burden on a user is significantly reduced.
  • encrypted session is established between the Web server and the registration server, the data are transmitted and received under encrypted communication environment.
  • FIG. 2 is a diagram showing a configuration of an example of the Web server according to the invention.
  • the Web server comprises communication means 20 , and communicates with a user terminal via the communication means 20 . Furthermore, the Web server has a control panel 21 , and the mail and the Web are configured and managed by the control panel 21 . Therefore, a mail function section 22 and a Web function section 23 are configured and managed by the control panel 21 .
  • applications 1 to 3 are incorporated and also a database 24 is incorporated.
  • the control panel 21 is provided with an SSL certificate issuing and managing program 25 , and under the control of this SSL certificate issuing and managing program 25 , the processes from the application for the issuance of the server certificate to the installation of the issued server certificate are executed in series.
  • FIG. 3 is a diagram showing functions of the SSL certificate issuing and managing program 25 of the control panel 21 .
  • random verification data are used as verification information for the user authentication.
  • entry screen generating means 30 is started, and the entry screen which is used to input the application information required for issuing the certificate is displayed on a monitor.
  • verification data generating means 31 operates to generate the random verification data.
  • Such verification data are the verification information which is used for user authentication and is generated by use of random numbers for example.
  • the generated verification data are supplied to verification page generating means 32 and server certificate request generating means 33 .
  • the verification page generating means 32 generates a verification page to indicate intention of the application for the issuance of the certificate, and displays the generated verification data as the verification information.
  • password generating means 34 When the application information has been completely inputted, password generating means 34 operates to generate a password which is used for encrypting the server certificate which is to be downloaded. This password is supplied to encrypting means 35 and is stored in a storage area 36 . The password stored in the storage area 36 is used to decrypt the server certificate downloaded from the registration server. The encrypting means 35 encrypts the generated password using the public key of the registration server to generate the encrypted password. The encrypted password is transmitted to the server certificate request generating means 33 . Between the Web server and the registration server, the encrypted session is established and higher security is assured. Thereby, although the password which is not encrypted is used, high security is ensured. Therefore, the password not being encrypted can be used. In this case, the password generated by the password generating means 34 is directly supplied to the server certificate request generating means.
  • the information contained in the application information such as the common name (FQDN: Fully Qualified Domain Name) of the Web server, the name and the e-mail address of the application administrator, and the validity start date and the validity period of the certificate is transmitted to the server certificate request generating means 33 .
  • the server certificate request generating means 33 the server certificate request containing the verification data and the encrypted password is generated and is transmitted to the registration server 10 provided in the registration authority, via the communication means 20 and the network 1 .
  • the URL of the verification page is generated by the registration server.
  • the SSL certificate issuing and managing program comprises status inquiry means 37 for periodically inquiring of the registration server 10 as to the issuance status of the certificate and receiving the response from the registration server, after transmitting the server certificate request. Furthermore, the SSL certificate issuing and managing program comprises server certificate download requesting means 38 for transmitting the download request to the registration server when the download notification has been transmitted from the registration server.
  • the downloaded server certificate is stored in server certificate storage means 39 .
  • FIG. 4 is a diagram showing an example of a computer system of the registration server 10 provided in the registration authority.
  • the certificate issuance request transmitted from the Web server is received by certificate request receiving means 51 via communication means 50 .
  • the received certificate request is assigned application ID by ID assigning means 52 and is temporally stored in the storage means 53 .
  • the certificate issuance request temporally stored in the storage means is sequentially read out and is examined by examining means 54 .
  • the examining means 54 checks the format of the certificate request, and decides whether or not predetermined application items are included. If the predetermined items are not included therein, such certificate request is processed to be an error.
  • verification information deriving means 55 operates to take out the verification data from the received server certificate request, and transmits the derived verification data to verification means 56 .
  • the FQDN is derived from the application information and transmitted to URL generating means 57 .
  • the URL generating means 57 generates URL information of the verification page formed in the Web server. This URL information is generated using the FQDN and a page title (page address information) contained in the application information.
  • the generated URL is transmitted to verification information reading means 58 .
  • the verification information reading means 58 accesses the verification page of the Web server identified by the generated URL to read out the verification information indicated thereon, and transmits the verification information to the verification means 56 .
  • the verification means 56 compares the verification data derived from the server certificate request with the verification information read from the verification page of the Web server to confirm whether or not they are identical to each other. If they are not identical to each other, such server certificate request is processed to be an error, and the error is transmitted from certificate request responding means 59 to the Web server. On the other hand, if the extracted verification data are identical to the verification information read from the Web server, this server certificate request is regarded as valid, and the certificate request responding means 59 transmits an acceptance completion notification to the Web server.
  • password deriving means 60 operates to take out the password from the server certificate request stored in the storage means 53 .
  • the derived password is transmitted to password decrypting means 61 .
  • key pair generating means 62 operates to generate the key pair of the public key and the private key.
  • the generated public key is transmitted to CSR generating means 64 to generate the CSR including the public key.
  • the generated CSR is transmitted from CSR transmitting means 63 to the certificate issuing server 11 provided in the certificate issuing authority (IA) via the communication means 50 and the network.
  • the certificate issuing server 11 When receiving the CSR transmitted from the registration server, the certificate issuing server 11 provides with the digital signature to generate the server certificate (SSL certificate) and transmits the generated server certificate to the registration server via the network.
  • SSL certificate server certificate
  • the registration server receives the server certificate transmitted from the certificate issuing server by server certificate receiving means 49 , and the received server certificate is transmitted to server certificate encrypting means 66 .
  • the password taken out by the password deriving means 60 is transmitted to the password decrypting 61 and is decrypted using the private key paired with the public key of the registration server.
  • the decrypted password is transmitted to the server certificate encrypting means 66 .
  • the private key generated by the key pair generating means 62 is also transmitted to the server certificate encrypting means 66 .
  • the server certificate encrypting means 66 encrypts the received server certificate and the private key using the decrypted password to form an encrypted file called as Pkcs (Public-Key Cryptography Standard) 12 file which is established as international standard. Encrypting and decrypting program which encrypts into Pkcs 12 file and decrypts the Pkcs 12 file is incorporated into the Web server as standard environment of Java (registered trade mark) and Windows (registered trade mark). Therefore, the encrypted server certificate and private key can be decrypted using the password in the Web server.
  • the encrypted server certificate and private key are stored in download area 67 . In case that the password which has not been encrypted is used to encrypt the generated server certificate, the password decrypting means 61 is not necessary.
  • the registration server comprises means 68 for receiving the certificate status inquiry transmitted from the Web server.
  • the status inquiry receiving means 68 confirms whether or not the server certificate is stored in the download area 67 using an application ID as a key. If the server certificate is not stored, noncompletion is notified to the Web server via status response transmitting means 69 . If the server certificate is stored, the download notification is transmitted via the status response transmitting means.
  • the download request from the Web server is received by certificate download request receiving means 70 . When the download request from the Web server is received, the server certificate is downloaded to the Web server by server certificate downloading means 71 via network.
  • the server certificate can be downloaded via the status response transmitting means 69 as a status response.
  • the server certificate and the private key which are converted into the Pkcs 12 file format and is downloaded from the registration server are stored in the server certificate storage means 39 .
  • the stored Pkcs 12 file is supplied to the decrypting means 40 and is decrypted into the server certificate and the private key using the password stored in the storage area 36 .
  • the decrypting means 40 decrypt the Pkcs 12 file by use of decryption conversion program corresponding to the encryption conversion program which is used by the registration server.
  • the decrypted server certificate is installed by the installing means 41 .
  • the decrypted private key is managed server securely. If the Web server is incorporated with interne information service (IIS) of Microsoft, the server certificate can be installed by directly inputting a password corresponding to the server certificate of Pkcs 12 format.
  • IIS interne information service
  • FIG. 5 is a diagram showing a procedure of the processes from the application for the issuance of the server certificate to the downloading of the server certificate, among the Web server, the registration server and the certificate issuing server.
  • the administrator or the person having authority to use of the Web server accesses the Web server managed by him/her to display the entry screen, and inputs the predetermined application matters.
  • the Web server Under the control of the control panel, the Web server generates the encrypted password and the random verification data, and also generates the server certificate request. Then, the Web server produces the verification page and indicates the verification data on the verification page.
  • the server certificate request is transmitted to the registration server 10 via the network.
  • the registration server checks the format of the server certificate request, and if there is an error in the inputted information, the registration server transmits the error.
  • the registration server accesses the verification page of the Web server to read out the verification information, and performs the verification process by comparing the read verification information with the verification data contained in the server certificate request. As a result of the verification, if the read verification information is not identical to the verification data, the registration server transmits the error. If the read verification information is identical to the verification data, the registration server transmits the acceptance completion notification to the Web server. Furthermore, the registration server generates the key pair and the CSR including the public key, and transmits the CSR to the certificate issuing server 11 .
  • the certificate issuing server provides the received CSR with the digital signature to generate the server certificate, and transmits the generated server certificate to the registration server.
  • the registration server decrypts the encrypted password contained in the server certificate request. Then, the registration server encrypts the received server certificate and the private key using the decrypted password to form the Pkcs 12 file.
  • the encrypted Pkcs 12 file including the encrypted server certificate and private key is stored in the download area.
  • the registration server receives the status inquiry periodically transmitted from the Web server, and confirms whether or not the server certificate is stored in the download area. If the server certificate is not stored, the registration server transmits the noncompletion notification to the Web server as the response. If the server certificate is stored in the download area, the registration server transmits the download notification to the status inquiry as the response.
  • the Web server transmits the download request to the registration server. In response to the download request, the registration server downloads the corresponding server certificate to the Web server.
  • the Web server Under the control of the control panel, the Web server installs the downloaded server certificate therein. That is, the Web server decrypts the downloaded server certificate and the private key using the password, and stores the private key in the managing area and also installs the server certificate using the installing means 37 . It should be noted that if automation of the downloading and the installation of the issued server certificate is not desired, it is also possible to download and install the issued server certificate with another means after receiving the download notification from the registration server.
  • the processes up to the installation of the server certificate are automatically executed only by inputting the matters required for the issuance of the server certificate by the administrator or the person having authority to use of the Web server, and thereby a procedural burden on the administrator is significantly reduced.
  • FIGS. 6 and 7 show a variation of the server certificate issuing system according to the invention.
  • FIG. 6 is a diagram showing the computer system of the Web server
  • FIG. 7 is a diagram showing the computer system of the registration server. It should be noted that the same reference numerals are assigned to the same component as those used in FIGS. 3 and 4 in the following description.
  • the verification information used for the user authentication is not limited to the random verification data generated from the random number, and can be generated by use of various information or data which is unique to the Web server.
  • the FQDN of the Web server and the application date are used as the verification information, and such information is encrypted using the public key of the registration authority, and the generated encrypted data are used as the verification information. Referring to FIG.
  • the FQDN of the Web server and the application date contained in the application information which is inputted into the entry screen information generating means 30 are supplied to the verification data generating means 31 .
  • the verification data generating means 31 encrypts the FQDN of the Web server and the application date using the public key of the registration authority to generate the verification data.
  • the generated verification data are transmitted to the verification page generating means 32 and are indicated on the verification page.
  • URL of the verification page is generated on the Web server side.
  • the FQDN contained in the application information is transmitted to URL generating means 80 to generate the URL information of the verification page.
  • URL generating means 80 generates the URL information of the random verification page using the FQDN and the title of the page (page address information) contained in the application information.
  • the generated URL is transmitted to the server certificate request generating means 33 .
  • the server certificate request generating means 33 transmits the server certificate request including the URL of the random verification page to the registration server.
  • FQDN and date deriving means 90 takes out the FQDN and the application date from the server certificate request and transmits them to encrypting means 91 .
  • the encrypting means 91 encrypts the FQDN and the date by use of the public key of the registration authority and transmits encrypted data to the verifying means 56 .
  • the URL of the random verification page is taken out by URL deriving means 92 and is transmitted to the verification information reading means 58 .
  • the verification information reading means 58 accesses the verification page of the Web server identified by the URL included in the server certificate request and reads out the verification information, and transmits the read verification information to the verifying means 56 .
  • the verification means 56 compares the verification information read from the random verification page of the Web server with the encrypted data transmitted from the encrypting means to perform the verification process. As a result of the verification, if the encrypted data and the verification information read from the Web server are identical to each other, it is determined that the Web server for which the server certificate is to be issued exists, and subsequent processes are continued. In this way, the security is also assured although various encrypted information is used as the verification information.
  • the common name (FQDN) of the server is converted into the IP address, and a telegram is routed to a targeted server.
  • the conversion (mapping) between the common name and the IP address is handled by a DNS.
  • the Mapping information is strictly managed in a machine referred to as “primary DNS” which manages a domain thereof, and is sequentially propagated to many DNS cache servers placed in a distributed manner on the Internet.
  • primary DNS which manages a domain thereof
  • an inquiry is started with the nearest DNS cache server. Since a DNS which is the basis thereof is managed in an extremely robust manner, the cache servers may become targets of hacker attacks.
  • the IP address of the Web server which can be obtained is identical to 1) the IP address obtained by directly inquiring of a DNS managing an appropriate domain registered in Whois DB, that is, the primary DNS and a secondary DNS, or 2) the IP address obtained by directly inquiring of a DNS managed and operated by a trusted third-party authority.
  • a local corruption of the DNS is detected by directly inquiring of the base DNS for which DNS information overwrite attacks targeted at the DNS cache servers are detected, or inquiring of a third major DNS which is strictly managed. Therefore, confirmation that the conversion from the common name to the IP address and the conversion from the IP address to the common name are inextricably linked is also effective in improving the security.
  • the security is dramatically improved by confirming identity between the IP address of the verification page and the IP address of the Web server which has transmitted the application for the issuance of the certificate, and also, for example, confirming identity between the IP address of the verification page at the time of the page verification and a result of directly inquiring of the DNS managing the appropriate domain registered as Whois information and the DNS of the trusted third-party.
  • the registration server comprises means for obtaining an IP address corresponding to a domain name of the Web server by directly accessing a primary domain name server (DNS) which manages a database storing a relationship between domain names and the IP addresses, and means for comparing the obtained IP address with the IP address of the verification page, and if these IP addresses are not identical to each other, the above described server certificate request can also be processed to be an error.
  • DNS primary domain name server
  • IP address/URL name at the time of the verification of the verification page as a log history is remarkably useful for analyzing a cause of omission, along with a log history at the control panel side.
  • the present invention is not limited to the above described embodiments, and various alterations and variations are possible.
  • the present invention is applicable to all Web servers. In this case, if a person having an ownership of the Web server makes the application for the issuance of the server certificate, the person can make the application for the issuance of the certificate via his/her own Web server.
  • the present invention is also applied to the case where these means are loaded in the Web server and not loaded on the control panel.
  • the present invention is also applicable to a shared Web server in which one Web server is shared by multiple persons.
  • the processes from the application for the issuance of the server certificate to the installation of the certificate have been performed under the control of the control panel provided in the Web server.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Information Transfer Between Computers (AREA)
US12/452,255 2007-06-27 2008-06-25 Server certificate issuing system Expired - Fee Related US8234490B2 (en)

Applications Claiming Priority (5)

Application Number Priority Date Filing Date Title
JP2007168777 2007-06-27
JP2007-168777 2007-06-27
JP2007262485A JP4128610B1 (ja) 2007-10-05 2007-10-05 サーバ証明書発行システム
JP2007-262485 2007-10-05
PCT/JP2008/061541 WO2009001855A1 (ja) 2007-06-27 2008-06-25 サーバ証明書発行システム

Publications (2)

Publication Number Publication Date
US20100111300A1 US20100111300A1 (en) 2010-05-06
US8234490B2 true US8234490B2 (en) 2012-07-31

Family

ID=40185668

Family Applications (1)

Application Number Title Priority Date Filing Date
US12/452,255 Expired - Fee Related US8234490B2 (en) 2007-06-27 2008-06-25 Server certificate issuing system

Country Status (5)

Country Link
US (1) US8234490B2 (zh)
EP (1) EP2154817B1 (zh)
JP (1) JP4494521B2 (zh)
CN (1) CN101828358B (zh)
WO (1) WO2009001855A1 (zh)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9300623B1 (en) * 2014-02-18 2016-03-29 Sprint Communications Company L.P. Domain name system cache integrity check
TWI831515B (zh) * 2022-12-13 2024-02-01 臺灣網路認證股份有限公司 自動化憑證申請與網域驗證系統及其方法

Families Citing this family (37)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100325687A1 (en) * 2009-06-22 2010-12-23 Iverson Gyle T Systems and Methods for Custom Device Automatic Password Management
US9160545B2 (en) * 2009-06-22 2015-10-13 Beyondtrust Software, Inc. Systems and methods for A2A and A2DB security using program authentication factors
US8863253B2 (en) 2009-06-22 2014-10-14 Beyondtrust Software, Inc. Systems and methods for automatic discovery of systems and accounts
US8713325B2 (en) * 2011-04-19 2014-04-29 Authentify Inc. Key management using quasi out of band authentication architecture
US8788811B2 (en) * 2010-05-28 2014-07-22 Red Hat, Inc. Server-side key generation for non-token clients
US9137017B2 (en) * 2010-05-28 2015-09-15 Red Hat, Inc. Key recovery mechanism
US20110296171A1 (en) * 2010-05-28 2011-12-01 Christina Fu Key recovery mechanism
JP5591037B2 (ja) * 2010-09-14 2014-09-17 パナソニック株式会社 電子情報導入システム、端末装置、サーバ装置、電子情報導入方法およびプログラム
US9832183B2 (en) 2011-04-19 2017-11-28 Early Warning Services, Llc Key management using quasi out of band authentication architecture
US9015469B2 (en) 2011-07-28 2015-04-21 Cloudflare, Inc. Supporting secure sessions in a cloud-based proxy service
US8745378B1 (en) * 2012-03-12 2014-06-03 Certified Security Solutions, Inc. System and method for validating SCEP certificate enrollment requests
US8738911B2 (en) * 2012-06-25 2014-05-27 At&T Intellectual Property I, L.P. Secure socket layer keystore and truststore generation
US8707027B1 (en) 2012-07-02 2014-04-22 Symantec Corporation Automatic configuration and provisioning of SSL server certificates
CN103139201B (zh) * 2013-01-22 2015-12-23 中兴通讯股份有限公司 一种网络策略获取方法及数据中心交换机
US8782774B1 (en) 2013-03-07 2014-07-15 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US9178888B2 (en) * 2013-06-14 2015-11-03 Go Daddy Operating Company, LLC Method for domain control validation
US9521138B2 (en) 2013-06-14 2016-12-13 Go Daddy Operating Company, LLC System for domain control validation
CN104917740B (zh) * 2014-03-14 2018-09-04 中国移动通信集团广东有限公司 一种密码重置方法、密码验证方法及装置
US8996873B1 (en) 2014-04-08 2015-03-31 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US8966267B1 (en) 2014-04-08 2015-02-24 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key
US9584492B2 (en) * 2014-06-23 2017-02-28 Vmware, Inc. Cryptographic proxy service
JP6521640B2 (ja) * 2015-01-14 2019-05-29 キヤノン株式会社 情報処理装置及びその制御方法、並びにプログラム
CA2980114C (en) * 2015-04-23 2020-03-10 Unho Choi Authentication in ubiquitous environment
US10791110B2 (en) * 2015-07-09 2020-09-29 Cloudflare, Inc. Certificate authority framework
US10305871B2 (en) 2015-12-09 2019-05-28 Cloudflare, Inc. Dynamically serving digital certificates based on secure session properties
CN105846996B (zh) * 2016-03-17 2019-03-12 上海携程商务有限公司 服务器证书的自动部署系统及方法
US10977361B2 (en) 2017-05-16 2021-04-13 Beyondtrust Software, Inc. Systems and methods for controlling privileged operations
CN109474432B (zh) 2017-09-07 2021-11-02 西安西电捷通无线网络通信股份有限公司 数字证书管理方法及设备
CN109741056B (zh) * 2018-12-26 2023-06-16 中国银联股份有限公司 一种电子凭证上传的方法及装置
CN110069941A (zh) * 2019-03-15 2019-07-30 深圳市买买提信息科技有限公司 一种接口访问鉴权方法、装置及计算机可读介质
GB2584018B (en) 2019-04-26 2022-04-13 Beyondtrust Software Inc Root-level application selective configuration
CN110730162B (zh) * 2019-09-16 2022-03-18 北京齐尔布莱特科技有限公司 一种页面的验证方法、移动终端、可读存储介质
JP7352092B2 (ja) * 2019-12-24 2023-09-28 富士通株式会社 制御方法、情報処理装置及び制御プログラム
US10903990B1 (en) 2020-03-11 2021-01-26 Cloudflare, Inc. Establishing a cryptographic tunnel between a first tunnel endpoint and a second tunnel endpoint where a private key used during the tunnel establishment is remotely located from the second tunnel endpoint
CN111460405B (zh) * 2020-03-17 2023-06-30 福建升腾资讯有限公司 一种柜外设备进入后台设置的方法、装置、设备和介质
JP7102461B2 (ja) * 2020-06-08 2022-07-19 一般財団法人日本情報経済社会推進協会 電子証明書導入・運用システム、電子証明書導入・運用方法、及び証明書申請装置
CN112235267A (zh) * 2020-09-29 2021-01-15 北京金山云网络技术有限公司 加载证书的方法、网页服务器、中继服务器、介质和系统

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH10340253A (ja) 1997-06-09 1998-12-22 Chugoku Nippon Denki Software Kk ホームページ情報の登録方法および装置
WO2003032572A1 (en) 2001-10-12 2003-04-17 Geo Trust, Inc. Methods and systems for automated authentication, processing and issuance of digital certificates
WO2003049358A1 (en) 2001-11-29 2003-06-12 Morgan Stanley A method and system for authenticating digital certificates
US20050081026A1 (en) * 2003-08-15 2005-04-14 Imcentric, Inc. Software product for installing SSL certificates to SSL-enablable devices
US20050080899A1 (en) * 2000-01-04 2005-04-14 Microsoft Corporation Updating trusted root certificates on a client computer
US7047409B1 (en) * 2000-06-09 2006-05-16 Northrop Grumman Corporation Automated tracking of certificate pedigree
US20060143442A1 (en) * 2004-12-24 2006-06-29 Smith Sander A Automated issuance of SSL certificates
US20070067465A1 (en) 2005-09-16 2007-03-22 Microsoft Corporation Validation of domain name control

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6035402A (en) * 1996-12-20 2000-03-07 Gte Cybertrust Solutions Incorporated Virtual certificate authority
US7346689B1 (en) * 1998-04-20 2008-03-18 Sun Microsystems, Inc. Computer architecture having a stateless human interface device and methods of use
ITRM20020335A1 (it) * 2002-06-14 2003-12-15 Telecom Italia Mobile Spa Metodo di autoregistrazione e rilascio automatizzato di certificati digitali e relativa architettura di rete che lo implementa.
US7395424B2 (en) * 2003-07-17 2008-07-01 International Business Machines Corporation Method and system for stepping up to certificate-based authentication without breaking an existing SSL session
AU2005255513A1 (en) * 2004-06-21 2005-12-29 Echoworx Corporation Method, system and computer program for protecting user credentials against security attacks

Patent Citations (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH10340253A (ja) 1997-06-09 1998-12-22 Chugoku Nippon Denki Software Kk ホームページ情報の登録方法および装置
US20050080899A1 (en) * 2000-01-04 2005-04-14 Microsoft Corporation Updating trusted root certificates on a client computer
US7047409B1 (en) * 2000-06-09 2006-05-16 Northrop Grumman Corporation Automated tracking of certificate pedigree
WO2003032572A1 (en) 2001-10-12 2003-04-17 Geo Trust, Inc. Methods and systems for automated authentication, processing and issuance of digital certificates
CA2463504A1 (en) 2001-10-12 2003-04-17 Geo Trust, Inc. Methods and systems for automated authentication, processing and issuance of digital certificates
US20030126431A1 (en) * 2001-10-12 2003-07-03 Beattie Douglas D. Methods and systems for automated authentication, processing and issuance of digital certificates
JP2005506737A (ja) 2001-10-12 2005-03-03 ジオトラスト インコーポレーテッド 自動認証処理及びディジタル証書発行方法及びシステム
WO2003049358A1 (en) 2001-11-29 2003-06-12 Morgan Stanley A method and system for authenticating digital certificates
JP2005512395A (ja) 2001-11-29 2005-04-28 モルガン・スタンレー 電子証明書を認証する方法およびシステム
EP1461891A1 (en) 2001-11-29 2004-09-29 Morgan Stanley A method and system for authenticating digital certificates
US20050081026A1 (en) * 2003-08-15 2005-04-14 Imcentric, Inc. Software product for installing SSL certificates to SSL-enablable devices
US20060143442A1 (en) * 2004-12-24 2006-06-29 Smith Sander A Automated issuance of SSL certificates
US20070067465A1 (en) 2005-09-16 2007-03-22 Microsoft Corporation Validation of domain name control

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
Park et al., "Certificate validation service using XKMS for computational grid", Oct. 2003, Proceedings of the 2003 ACM workshop on XML security, pp. 112-120. *
Taban et al. "Towards a secure and interoperable DRM architecture", Oct. 2006, Proceedings of the 2006 ACM workshop on Digital rights management, pp. 69-78. *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9300623B1 (en) * 2014-02-18 2016-03-29 Sprint Communications Company L.P. Domain name system cache integrity check
TWI831515B (zh) * 2022-12-13 2024-02-01 臺灣網路認證股份有限公司 自動化憑證申請與網域驗證系統及其方法

Also Published As

Publication number Publication date
JPWO2009001855A1 (ja) 2010-08-26
CN101828358B (zh) 2012-07-04
EP2154817A1 (en) 2010-02-17
JP4494521B2 (ja) 2010-06-30
EP2154817B1 (en) 2013-09-04
WO2009001855A1 (ja) 2008-12-31
US20100111300A1 (en) 2010-05-06
EP2154817A4 (en) 2012-04-11
CN101828358A (zh) 2010-09-08

Similar Documents

Publication Publication Date Title
US8234490B2 (en) Server certificate issuing system
EP2200217B1 (en) Server certificate issuance system
US8250361B2 (en) Server certificate issuing system and person authentication method
US7146009B2 (en) Secure electronic messaging system requiring key retrieval for deriving decryption keys
US8812838B2 (en) Configuring a valid duration period for a digital certificate
US8364771B2 (en) Tools for generating PKI email accounts
US6792531B2 (en) Method and system for revocation of certificates used to certify public key users
US6092201A (en) Method and apparatus for extending secure communication operations via a shared list
US20070055867A1 (en) System and method for secure provisioning of encryption keys
US8117438B1 (en) Method and apparatus for providing secure messaging service certificate registration
US20150121069A1 (en) Embedded extrinsic source for digital certificate validation
US20110296172A1 (en) Server-side key generation for non-token clients
US20100138907A1 (en) Method and system for generating digital certificates and certificate signing requests
US20100023757A1 (en) Methods and systems for sending secure electronic data
JP2006060779A (ja) 証明書送信装置、通信システム、証明書送信方法、プログラム及び記録媒体
US20080187140A1 (en) Method and System of Securely Transmitting Electronic Mail
US8719574B2 (en) Certificate generation using virtual attributes
JP2007053569A (ja) 電子メールセキュリティ化装置及び該システム
Spies Public key infrastructure
IES20070726A2 (en) Automated authenticated certificate renewal system
Jeziorski et al. Verification of Certificate Authorities (CAs) and integration with cloud providers for enhanced security
CN114996770A (zh) 基于宿管系统的身份识别方法
IES85034Y1 (en) Automated authenticated certificate renewal system

Legal Events

Date Code Title Description
AS Assignment

Owner name: GLOBALSIGN K.K.,JAPAN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KIDO, KEISUKE;CHUJO, ICHIRO;REEL/FRAME:023718/0202

Effective date: 20091218

Owner name: GLOBALSIGN K.K., JAPAN

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:KIDO, KEISUKE;CHUJO, ICHIRO;REEL/FRAME:023718/0202

Effective date: 20091218

STCF Information on status: patent grant

Free format text: PATENTED CASE

FEPP Fee payment procedure

Free format text: PAT HOLDER NO LONGER CLAIMS SMALL ENTITY STATUS, ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: STOL); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

FPAY Fee payment

Year of fee payment: 4

FEPP Fee payment procedure

Free format text: MAINTENANCE FEE REMINDER MAILED (ORIGINAL EVENT CODE: REM.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

LAPS Lapse for failure to pay maintenance fees

Free format text: PATENT EXPIRED FOR FAILURE TO PAY MAINTENANCE FEES (ORIGINAL EVENT CODE: EXP.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY

STCH Information on status: patent discontinuation

Free format text: PATENT EXPIRED DUE TO NONPAYMENT OF MAINTENANCE FEES UNDER 37 CFR 1.362

FP Lapsed due to failure to pay maintenance fee

Effective date: 20200731